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RELATED APPEALS AND INTERFERENCES 
There are no known related appeals and interferences. 

STATUS OF CLAIMS 
Claims 1-20 stand finally rejected under 35 U.S.C. §103(a). Claims 1-20 are appealed. 

STATUS OF AMENDMENTS 
There has been no amendment filed subsequent to the final rejection. However, a Response 
to Final Office Action was filed on July 8, 2003, along with the Notice of Appeal. 

SUMMARY OF INVENTION 

The present invention provides techniques for use in analyzing non-fully structured data 
which is associated with one or more events. In one aspect, a technique of the invention comprises 
the following steps. At least a portion of the non-fully structured data is parsed according to one or 
more parsing rules to convert the at least a portion of non-fully structured data to structured data. 
Presentation operations are provided which are respectively able to provide a presentation of at least 
a portion of the non-fully structured data, format at least a portion of the structured data to provide 
a presentation of a graphical representation of the at least a portion of structured data, and format at 
least a portion of the structured data to provide a presentation of a summary representation of the at 
least a portion of structured data. Data associated with two or more of the presentations is 
coordinated, when desired, to enable a coordinated analysis of the data (Specification, page 6, line 
3, through page 7, line 2; and page 20, lines 3-12). 

Thus, the present invention provides systems and methods for providing exploratory analysis 
of data for event management. In an illustrative embodiment, the invention provides for a 
methodology and related system referred to hereinafter as an "event browser" that provides an 
integrated environment for analysis of a large volumes of semi-structured or non-structured data, 
such as event logs. In such an illustrative embodiment of the invention, the event browser 
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advantageously provides: (1) scalable analysis of large volumes of unstructured data with diverse 
content and data formats; (2) an architecture to support multiple types of views and analyses of such 
data; (3) mechanisms to support the iterative refinement of the information in the raw data that is 
included in the visualization and analysis environment; (4) several specific viewers for analysis of 
event data (Specification, page 4, lines 9-19). 

An event browser of the invention may be implemented in a form which includes certain 
functional components. To deal with textual messages directly, the event browser of the invention 
may integrate a parsing mechanism or engine (e.g., parser 20 of FIG. 1) and an analysis tool (e.g., 
analysis tool 25 of FIG. 1) in one package. The role of the parsing engine may be to translate an 
event message into a set of attribute values defined by parsing rules (e.g., rules 30 of FIG. 1). For 
example, if parsing rules define information about host name, event type and time stamp, an event 
message is translated into a tuple of {host name, event type, time} through the parsing. In other 
words, the parsing engine may translate semi-structured or non-structured textual data into structured 
data. The analysis tool, therefore, does not need to worry about the detailed message format, and can 
focus on analysis and the GUI (graphical user interface) to an end-user. As a result, the detailed 
textual format of a log file is preferably hidden from an end-user, until he wants to see it. This 
allows users to analyze log files with different formats in a unified and simple way (Specification, 
page 4, line 20, through page 5, line 6). 

To take advantages of different analysis techniques, an event browser of the invention may 
provide an extensible architecture to integrate event graphs (e.g., "plot viewer" as illustrated in FIG. 
14), event summarization (e.g., "attribute viewer" as illustrated in FIG. 12), detailed message ( e.g., 
"message viewer" as illustrated in FIG. 17) and other possible viewers. Further, the event browser 
may provide an infrastructure for exchanging information amongst the viewers. Each of these three 
viewers has its own advantages for viewing and manipulating data. For example, the attribute 
viewer of the invention may be good at summarization and query-type operations. From the attribute 
viewer, a user may conveniently select all events associated with a set of hosts and event types. It 
also may summarize events by their host types and event types and thus provide summarization of 



Attorney Docket No.: YQ999-131 



a log to a user. The plot viewer of the invention may display a large amount of individual events in 
one window. Therefore, a user may view event relationships and discover event patterns. In 
addition, through the use of standard visualization techniques, a user may zoom in for details and 
zoom out for a larger view, and rubber-band to select "interesting 11 events. The message viewer of 
the invention may provide the capability to view a set of raw event messages. This may enable a 
user to further see detailed and application specific information which may be very difficult to parse 
out or not worth parsing out, but may be needed for diagnosis (Specification, page 6, lines 6-18). 

The event browser of the invention may not only provide these three individual viewers, but 
also may combine and coordinate two or more of these viewers for analyzing events. For example, 
a user can very easily select a set of interesting events for a set of hosts and event types from the 
attribute viewer by highlighting these hosts and event types, then use the plot viewer to see the 
relationship among the selected events. From the plot viewer, he can further select a small set of 
suspicious events by dragging a rubber-band, and displaying the original textual messages related 
to the selected events in the message viewer. Further, by highlighting, coloring, or otherwise 
selecting events in one viewer, he can cause to have similarly modified presentations of these events 
in other viewers. This capability is referred to as "coordinated views." Accordingly, the event 
browser provides a novel event visualization and analysis platform and can assist a user in 
discovering "useful" information which can not be revealed by any conventional tool (Specification, 
page 6, line 19, through page 7, line 2). 

In another aspect of the invention, the event browser may provide interactive and iterative 
refinement of parsing rules. A role of a parsing engine is to pick out the important information from 
textual messages and translate the unstructured data into structured data for analysis. Therefore, the 
ability of analysis tools highly depends on what is parsed. In practice, finding the right information 
to parse out from a message is not an easy task, because a raw message contains various levels of 
details and a user certainly does not want to be flooded by this information. Usually, at first, a user 
is only interested in the most important information, such as host name and event type. But as the 
user analyzes the data, the user may want more details or other types of information, such as 
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destination or severity level. Therefore, the parsing rule needs to be redefined to include additional 
information. Conventionally, the process of defining parsing rules is done in an isolated way. That 
is, if a user needs more information, the user has to use a separate tool to edit the parsing rule file, 
and then rerun the parsing and the analysis. Since the event browser integrates parsing engine and 
analysis, it provides a feedback loop for a user to modify parsing rules in an integrated environment 
(Specification, page 7, lines 3-17). 

ISSUE PRESENTED FOR REVIEW 
Whether claims 1-20 are unpatentable under 35 U.S.C. § 103(a) over U.S. Patent No. 
6,1 18,936 to Lauer (hereinafter "Lauer") in view of Appellants' specification at page 2, lines 18, 19, 
26 and 27 (hereinafter "alleged APA") and further in view of U.S. Patent No. 5,867,229 to Stevens 
(hereinafter "Stevens"). 

GROUPING OF CLAIMS 
Claims 1, 4-12 and 15-20 stand or fall together. Claims 2 and 13 stand or fall together. 
Claims 3 and 14 stand or fall together. 

ARGUMENT 

Appellants incorporate by reference herein the disclosure of all previous responses filed in 
the present application, namely: an Amendment and Response to Office Action dated January 13, 
2003; a Response to Final Office Action dated July 8, 2003; and an Appeal Brief dated November 
10, 2003. 

Before presenting substantive arguments, Appellants again respectfully point out that a 
petition for a two-month extension of time had been filed concurrent with the Appeal Brief dated 
November 10, 2003. However, Appellants believe that such an extension was necessitated due to 
an unreasonable delay on the part of the U.S. Patent and Trademark Office in responding to 
Appellants' Response to Final Office Action. That is, Appellants filed the Response to Final Office 
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Action and Notice of Appeal on July 8, 2003, which was stamped as being received by OPIE on July 
10, 2003. Nonetheless, after making several inquiries to the U.S. Patent and Trademark Office, 
including to the Examiner, Appellants did not receive an Advisory Action until over 3 Vi months 
after filing the Response to Final Office Action and Notice of Appeal, i.e, October 30, 2003, thus 
necessitating the two-month extension of time. Appellants respectfully request reimbursement of 
the fee associated with the extension of time to the degree that the delay was not caused by 
Appellants. Appellants would also appreciate express acknowledgment that such request is being 
considered or has been considered, and an indication of any decision pertaining to such request. 

Turning now to the substantive issue of whether claims 1-20 are unpatentable under 35 
U.S.C. § 103(a) over Lauer in view of the alleged APA in further view of Stevens, the present Office 
Action contends that the cited combination discloses all of the claim limitations recited in the subject 
claims. More particularly, the present Office Action introduces a new reference, Stevens, in 
combination with Lauer and the alleged APA, in order to attempt to establish a prima facie case of 
obviousness under 35 U.S.C. § 1 03(a). Appellants respectfully assert that the cited combination fails 
to establish a prima facie case of obviousness under 35 U.S.C. § 103(a), as specified in M.P.E.P. 
§2143. 

As set forth therein, M.P.E.P. §2143 states that three requirements must be met to establish 
a prima facie case of obviousness. First, there must be some suggestion or motivation to combine 
reference teachings. Second, there must be a reasonable expectation of success. Third, the cited 
combination must teach or suggest all the claim limitations. While it is sufficient to show that a 
prima facie case of obviousness has not been established by showing that one of the requirements 
has not been met, Appellants respectfully believe that none of the requirements have been met. 

As pointed out in Appellants' previous responses, the present invention, for example as 
recited in independent claim 1, defines a processor-based method for use in analyzing non-fully 
structured data which is associated with one or more events, comprising the following steps. At least 
a portion of the non-fully structured data is parsed according to one or more parsing rules to convert 
the at least a portion of non-fully structured data to structured data. Presentation operations are 
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provided which are respectively able to provide a presentation of at least a portion of the non-fiilly 
structured data, format at least a portion of the structured data to provide a presentation of a graphical 
representation of the at least a portion of structured data, and format at least a portion of the 
structured data to provide a presentation of a summary representation of the at least a portion of 
structured data. Data associated with two or more of the presentations is coordinated, when desired, 
to enable a coordinated analysis of the data. Independent claim 9 defines a system-based invention 
having similar limitations, while independent claim 12 and independent claim 20 respectively define 
an apparatus-based invention and an article of manufacture-based invention having similar 
limitations. 

Lauer is directed to a signaling network management system for converting network events 
into standard form and then correlating the standard form events with topology and maintenance 
information. The alleged APA on page 2 of Appellants' specification refers to mutually exclusive 
data viewing approaches, i.e., viewing raw data, viewing summary information, and viewing 
graphical displays. Stevens is directed to techniques for providing video effects using a video 
record/playback device. 

First, Appellants assert that no motivation or suggestion exists to combine Lauer, the alleged 
APA, and Stevens. For at least this reason, a prima facie case of obviousness has not been 
established. As asserted in Appellants' previous responses, motivation to combine cannot come 
from the [Appellants'] own specification . This is impermissible hindsight. In fact, Appellants' 
specification points out the very deficiencies from which approaches such as those taught by Lauer 
suffer. 

Appellants' specification at page 2, line 1 8, through page 4, line 7 (the source of the alleged 
APA) describes three different, but mutually exclusive , ways to analyze event logs, i.e, viewing raw 
data, viewing summary information, and viewing graphical displays. As pointed out, each of them 
has its own advantages. Directly reading the textual messages provides the most detailed 
information of event messages. The aggregated event analysis provides a nice scaling property and 
shows summarization. The event plot can reveal event patterns and relationship among events. 
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Most available products for analyzing a log file specialize on one type of log file. Unfortunately, all 
of these special log analyzers only support summarization analysis. None of them can be used to 
visualize event messages and/or see original messages. On the other hand, there are many general 
graphical tools. These tools aim to support either graphical analysis of numerical data or aggregated 
level summarization. However, none of them provide both types of analysis. In addition, these tools 
usually only take structured data as inputs and can not handle textual data directly. 

Further, Appellants' specification points out that there are many general graphical tools, such 
as Diamond, Data explorer, SAS, PowerPlay, etc. These tools aim to support either graphical 
analysis of numerical data, such as Diamond, Data explorer, SAS, etc., or aggregated level 
summarization such as PowerPlay and other OLAP (On Line Analytical Process) products. 
However, none of them provide both types of analysis. In addition, these tools usually only take 
structured data as inputs and can not handle textual data directly. 

Therefore, as the specification explains, it would be highly desirable to provide systems and 
methods which integrate different analysis approaches, thus providing a user with the capability and 
flexibility to perform multiple types of analysis on raw data for event management purposes. This 
is what the claimed invention is directed toward . 

Despite the Examiner's contention, there is nothing in Lauer nor Stevens that would suggest 
motivation to yield the integrated presentation and analysis approach of the claimed invention. 
Further, since the approaches described in the specification are generally mutually exclusive, there 
is no known motivation to combine any of them into a single presentation and analysis technique, 
as in the claimed invention. 

Furthermore, the Federal Circuit has stated that when patentability turns on the question of 
obviousness, the obviousness determination "must be based on objective evidence of record" and 
that "this precedent has been reinforced in myriad decisions, and cannot be dispensed with." In re 
Lee . 277 F.3d 1338, 1343 (Fed. Cir. 2002). Moreover, the Federal Circuit has stated that 
"conclusory statements" by an examiner fail to adequately address the factual question of motivation, 
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which is material to patentability and cannot be resolved "on subjective belief and unknown 
authority." Id. at 1343-1344. 

In the present Office Action at pages 3 and 4, the Examiner provides the following statements 
to prove motivation to combine Lauer, the alleged APA, and Stevens, with emphasis supplied: "[i]t 
would have been obvious to apply the teachings of APA to the system of Lauer because this provides 
the user different approaches to view the structured data . . . [i]t would have been obvious to apply 
the teachings of Stevens to the system of Lauer for analysis purpose[s] because the user can view 
different representations of the data at the same time . . . therefore providing the user great flexibility 
while reducing the time required for analysis ." 

Appellants again submit that these statements are based on the type of "subjective belief and 
unknown authority" that the Federal Circuit has indicated provides insufficient support for an 
obviousness rejection. More specifically, the Examiner fails to identify any objective evidence of 
record which supports the proposed combination. Again, motivation to combine cannot come from 
the Appellants' own specification. Also, the "great flexibility" that the Examiner cites is apparently 
taken from Stevens (column 3, lines 7 and 8). However, the "great flexibility" referred to in Stevens 
has to do with the "stop action and slow motion control" provided by the video record/playback 
device of Stevens and not anything to do with multiple playback views. 

Second, Appellants assert that there is no reasonable expectation of success in achieving the 
present invention through a combination of Lauer, the alleged APA, and Stevens. For at least this 
reason, a prima facie case of obviousness has not been established. As mentioned above, despite the 
assertion in the outstanding Office Action, Appellants do not believe that Lauer, the alleged APA, 
and Stevens are combinable since it is not clear how one would combine them given that the various 
approaches are mutually exclusive. There are no teachings in the cited combination as to how to 
coordinate data associated with two or more of the presentations, when desired, to enable a 
coordinated analysis of the data, as in the claimed invention. 

Third, Appellants assert that the combination of Lauer, the alleged APA, and Stevens fails 
to teach or suggest all of the claim limitations of independent claims 1,9, 12 and 20. For at least this 
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reason, a prima facie case of obviousness has not been established. Again, assuming arguendo that 
Lauer, the alleged APA, and Stevens could be properly combined, which for at least the reasons 
above it is believed that they can not be properly combined, the combination fails to teach or suggest 
all claim elements in independent claims 1,9, 12 and 20. 

By way of example, the inventions of claims 1, 9, 12 and 20 recite "coordinating data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data." This is explained, for example, at page 6 of the specification where it is stated that the 
invention not only preferably provides multiple viewers, but also combines and coordinates these 
viewers for analyzing events. For example, a user can very easily select a set of interesting events 
for a set of hosts and event types from the attribute viewer (e.g., summary viewing) by highlighting 
these hosts and event types, then use the plot viewer (e.g., graphical viewing) to see the relationship 
among the selected events. From the plot viewer, he can further select a small set of suspicious 
events by dragging a rubber-band, and displaying the original textual messages related to the selected 
events in the message viewer (e.g., raw data viewing). Further, by highlighting, coloring, or 
otherwise selecting events in one viewer, he can cause to have similarly modified presentations of 
these events in other viewers. 

Assuming arguendo that it is proper to combine Lauer, the alleged APA, and Stevens to yield 
a group of presentation techniques, the cited combination is silent as to "coordinating data associated 
with two or more of the presentations, when desired, to enable a coordinated analysis of the data," 
as expressly recited in independent claims 1, 9, 12 and 20. The Office Action points to column 2, 
line 64, through column 3, line 3, of Stevens as teaching the claimed coordination feature. However, 
this portion of Stevens is very different than the claimed feature. The cited portion of Stevens states: 

FIG. 4 shows an event, indicated by the stick ... 32, being simultaneously recorded 
via four different video cameras 34 a-d. The four views of the same event are stored in the 
random storage system 10, and then may be played back synchronously and simultaneously 
as four displays. In this manner a single event may be analyzed in real time or slow motion 
at the same time without requiring mental correlation and synchronization of the event for 
individual views. For example for instant replay at a sporting event, the replay referee sees 
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the same image from different views simultaneously rather than having to look at each view 
separately in sequence. With the stop action and slow motion control this provides great 
flexibility while reducing the time required for the analysis. 

Thus, it is clear that Stevens is not "coordinating data associated with two or more of the 
presentations, when desired, to enable a coordinated analysis of the data," as in the claimed 
invention. 

As explained above, in an embodiment of the invention, not only are three individual viewers 
provided, but the invention also provides combining and coordinating two or more of these viewers 
for analyzing events. For example, a user can very easily select a set of interesting events for a set 
of hosts and event types from the attribute viewer by highlighting these hosts and event types, then 
use the plot viewer to see the relationship among the selected events. From the plot viewer, he can 
further select a small set of suspicious events by dragging a rubber-band, and displaying the original 
textual messages related to the selected events in the message viewer. Further, by highlighting, 
coloring, or otherwise selecting events in one viewer, he can cause to have similarly modified 
presentations of these events in other viewers. This capability is referred to as "coordinated views." 
Accordingly, the invention provides a novel event visualization and analysis platform and can assist 
a user in discovering "useful" information which can not be revealed by any conventional tool 
(Specification, page 6, line 19, through page 7, line 2). 

In contrast, Stevens merely plays back four different views of an event as four separate 
displays. There is no "coordinating data associated with two or more of the presentations, when 
desired, to enable a coordinated analysis of the data." In fact, Stevens states that there is no 
"synchronization of the event for individual views" (column 3, line 2). 

Lastly, Appellants assert that a combination of Stevens with Lauer or the alleged APA is 
improper since Stevens is clearly non-analogous art. As mentioned above, Lauer is directed to a 
signaling network management system for converting network events into standard form and then 
correlating the standard form events with topology and maintenance information. The alleged APA 
on page 2 of Appellants' specification refers to mutually exclusive data viewing approaches 
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associated with managing networked systems and applications, i.e., viewing raw data, viewing 
summary information, and viewing graphical displays. Stevens is directed to techniques for 
providing video effects using a video record/playback device. Thus, while Lauer and the alleged 
APA is directed toward network event management, Stevens has nothing to do with network event 
management. Rather, Stevens is limited to a multiple access record/playback device, such as a 
digital disk recorder, used for video effects (see Abstract of Stevens). Appellants assert that one 
skilled in the art of network event management would not look to teachings pertaining to a multiple 
access record/playback device used for video effects such as Stevens. Thus, a combination including 
Stevens is improper. 

For at least the above reasons, Appellants respectfully request withdrawal of the §103 
rejections of independent claims 1,9, 12 and 20. 

The remainder of the claims rejected over the Lauer-alleged APA-Stevens combination 
depend, either directly or indirectly, from claims 1, 9 or 12, which are believed patentable for the 
reasons set forth above. Furthermore, the remaining claims define additional patentable subject 
matter in their own right. 

By way of example only, claims 2 and 13 recite the step/operation of providing coordinated 
views for at least two of the graphical representation, the summary representation and the non-fully 
structured data presentation. The present Office Action again relies on Stevens in rejecting this 
claimed feature. However, as explained above, Stevens is completely silent as to providing 
"coordinated views." 

Further, by way of example only, claims 3 and 14 recite the step/operation of modifying one 
or more parsing rules to affect the parsing operation. The portion of Lauer cited to support this 
rejection (i.e., column 14, lines 50-52) deals with modifying a presentation, not modifying parsing 
rules. The present Office Action fails to address this deficiency. 

For at least the above reasons, Appellants respectfully request withdrawal of the §103 
rejections of dependent claims 2-8, 10, 11 and 13-19. 
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Accordingly, for at least the foregoing reasons, claims 1 -20 are believed to be patentable over 
the cited references. As such, the application is asserted to be in condition for allowance, and 
favorable action is respectfully solicited. 



Respectfully submitted, 



Date: May 3, 2004 William E. Lewis 

Attorney for Applicant(s) 
Reg. No. 39,274 
Ryan, Mason & Lewis, LLP 
90 Forest Avenue 
Locust Valley, NY 11560 
(516) 759-2946 
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APPENDIX 

1. A processor-based method for use in analyzing non-fully structured data which is 
associated with one or more events, the method comprising the steps of: 

parsing at least a portion of the non- fully structured data according to one or more parsing 
rules to convert the at least a portion of non-fully structured data to structured data; 

providing presentation operations which are respectively able to provide a presentation of at 
least a portion of the non-fully structured data, format at least a portion of the structured data to 
provide a presentation of a graphical representation of the at least a portion of structured data, and 
format at least a portion of the structured data to provide a presentation of a summary representation 
of the at least a portion of structured data; and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data. 

2. The method of Claim 1, further comprising the step of providing coordinated views for 
at least two of the graphical representation, the summary representation and the non-fully structured 
data presentation. 

3 . The method of Claim 1 , further comprising the step of modifying the one or more parsing 
rules to affect the parsing operation. 

4. The method of Claim 1, further comprising the step of providing a rubber-banding 
operation in association with the graphical representation. 

5. The method of Claim 1 , further comprising the step of providing a zooming operation in 
association with the graphical representation. 
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6. The method of Claim 1, wherein the summary representation includes one or more 
attributes associated with the at least a portion of structured data. 

7. The method of Claim 1 , further comprising the step of providing a selection operation in 
association with aspects of at least one of the non-fully structured data and the structured data. 

8. The method of Claim 1, further comprising the step of providing a filtering operation in 
association with aspects of at least one of the non-fully structured data and the structured data. 

9. A system for use in analyzing non-fully structured data which is associated with one or 
more events, the system comprising: 

a parsing engine which parses at least a portion of the non-fully structured data according to 
one or more parsing rules to convert the at least a portion of non-fully structured data to structured 
data; 

viewers which are respectively able to provide a presentation of at least a portion of the non- 
fully structured data, format at least a portion of the structured data to provide a presentation of a 
graphical representation of the at least a portion of structured data, and format at least a portion of 
the structured data to provide a presentation of a summary representation of the at least a portion of 
structured data , wherein data associated with two or more of the presentations is coordinated, when 
desired, to enable a coordinated analysis of the data; and 

a selection and control engine coupled to the parsing engine and the viewers which controls 
operations associated with the parsing engine and the viewers. 

10. The system of Claim 9, wherein the operations controlled by the selection and control 
engine include at least one of data and parsing rule access. 
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11. The system of Claim 9, wherein the operations controlled by the selection and control 
engine include communications between the viewers. 

12. Apparatus for use in analyzing non- fully structured data which is associated with one or 
more events, the apparatus comprising: 

at least one processor operable to: (i) parse at least a portion of the non-fully structured data 
according to one or more parsing rules to convert the at least a portion of non-fully structured data 
to structured data; (ii) provide presentation operations which are respectively able to provide a 
presentation of at least a portion of the non-fully structured data, format at least a portion of the 
structured data to provide a presentation of a graphical representation of the at least a portion of 
structured data, and format at least a portion of the structured data to provide a presentation of a 
summary representation of the at least a portion of structured data; and (iii) coordinate data 
associated with two or more of the presentations, when desired, to enable a coordinated analysis of 
the data; and 

memory coupled to the at least one processor for storing at least one of the non-fully 
structured data, the structured data and the one or more parsing rules. 

13. The apparatus of Claim 12, wherein the at least one processor is further operable to 
provide coordinated views for at least two of the graphical representation, the summary 
representation and the non-fully structured data presentation. 

14. The apparatus of Claim 12, wherein the at least one processor is further operable to 
modify the one or more parsing rules to affect the parsing operation. 

15. The apparatus of Claim 12, wherein the at least one processor is further operable to 
provide a rubber-banding operation in association with the graphical representation. 
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16. The apparatus of Claim 12, wherein the at least one processor is further operable to 
provide a zooming operation in association with the graphical representation. 

17. The apparatus of Claim 12, wherein the summary representation includes one or more 
attributes associated with the at least a portion of structured data. 

18. The apparatus of Claim 12, wherein the at least one processor is further operable to 
provide a selection operation in association with aspects of at least one of the non-fully structured 
data and the structured data. 

19. The apparatus of Claim 12, wherein the at least one processor is further operable to 
provide a filtering operation in association with aspects of at least one of the non-fully structured 
data and the structured data. 

20. An article of manufacture for use in analyzing non-fully structured data which is 
associated with one or more events, comprising a machine readable medium containing one or more 
programs which when executed implement the steps of: 

parsing at least a portion of the non-fully structured data according to one or more parsing 
rules to convert the at least a portion of non-fully structured data to structured data; 

providing presentation operations which are respectively able to provide a presentation of at 
least a portion of the non-fully structured data, format at least a portion of the structured data to 
provide a presentation of a graphical representation of the at least a portion of structured data, and 
format at least a portion of the structured data to provide a presentation of a summary representation 
of the at least a portion of structured data; and 

coordinating data associated with two or more of the presentations, when desired, to enable 
a coordinated analysis of the data. 

17 



